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Abstract 

In the 1920s, Ackermann and von Neumann, in pursuit of Hilbert's Programme, 
were working on consistency proofs for arithmetical systems. One proposed method 
of giving such proofs is Hilbert's epsilon-substitution method. There was, how- 
ever, a second approach which was not reflected in the publications of the Hilbert 
school in the 1920s, and which is a direct precursor of Hilbert's first epsilon the- 
orem and a certain 'general consistency result' due to Bernays. An analysis of 
the form of this so-called 'failed proof sheds further light on an interpretation of 
Hilbert's Programme as an instrumentalist enterprise with the aim of showing that 
whenever a 'real' proposition can be proved by 'ideal' means, it can also be proved 
by 'real', finitary means. 

1 Introduction 

The aim of Hilbert's Programme for consistency proofs in the 1920s is well known: 
to formalize mathematics, and to give finitary consistency proofs of these systems and 
thus to put mathematics on a 'secure foundation'. What is perhaps less well known is 
exactly how Hilbert thought this should be carried out. Over ten years before Gentzen 
developed sequent calculus formalizations of arithmetic and used an elaboration of his 
cut-elimination procedure to give a consistency proof of Peano Arithmetic, Hilbert pro- 
posed a different approach. He believed that the principles criticized by intuitionists, 
the principle of the excluded middle in its application to infinite totalities and the use 
of unbounded existential quantifiers are, at root, the same. This root is the axiom of 
choice. In a course on the foundations of mathematics, he remarked that whereas the 
use of unbounded quantification results in significant problems for giving a consistency 
proof, 
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the core of the difficulty lies at a different point, to which one usually 
only pays attention later: it lies with Zermelo's axiom of choice. . . We want 
to extend the axiom of choice. To each proposition with a variable A (a) we 
assign an object for which the proposition holds only if is holds in general. 
So, a counterexample, if one exists.' 

This counterexample is given by the T-operator: 'ixA{x) is an object for which A (x) is 
false, if there is one. The dual operator exA{x), is a witness, i.e., an object for which 
A(x) is true, if A(x) is true for anything.^ The e-operator is governed by the transfinite 
axiom, 

A(fl) A(e^A(jt:)). 

A finitary consistency proof of mathematical theorems which allows the elimination 
of applications of the choice principle (in the form given to it by the transfinite ax- 
iom) would then show that such application is justified after all. It would also show 
that unbounded quantification is admissible in mathematics, since with the help of the 
transfinite axioms one can define quantifiers by 

(3x)A (x) = A (e,A [x) ) and (Vx)A (x) = A (e,^A (x) ) . 

e-terms may be seen as ideal elements whose addition to the theory of finite propo- 
sitions reintroduces the powerful methods of infinite mathematics, and 'round out the 
theory'. To show that their addition is permissible requires a proof that e-terms can 
be eliminated from proofs of 'real', finitary, propositions. This elimination of e-terms 
from formal proofs in arithmetical theories was to proceed according to the epsilon- 
substitution method. Hilbert's approach here was to define a finitary procedure which 
would produce, given a proof involving e-terms, a substitution of these terms by actual 
numbers.^ Applying this substitution to the proof would then result in a purely ele- 
mentary proof about numbers which would contain no trace of the transfinite elements 
of the original proof. In addition, it is seen finitarily that all initial formulas, and hence 
also the end formula, of the resulting proof are true. Since such a proof cannot possibly 
have a contradiction as its last line, the consistency of arithmetic would be established. 
Hilbert pres ented his 'Ansatz' f or fi nding such substitutio ns in .Hilbert C 1922c) : it was 
extended bv lAckermannl ll 1 924) and Ivon NeumannI ll 1 927l) . 

The epsilon-substitution method and its role in Hilbert's Programme are now rela- 
tively well understood. There was, however, a second proposal for proving consistency, 
also based on the epsilon calculus, which has escaped historical attention, and which 
was never presented in the publications of the Hilbert school before 1939. In the sec- 
ond volume of Grundlagen der Mathematik ( Hilbe rt and Be rnays, 1939), Bernays first 
developed in print a well worked-out theory of the epsilon calculus as an alternative 
formulation and extension of predicate logic, and proved the so-called first and second 
epsilon theorems. In Section 1.4, Bernays presented a 'general consistency theorem' 
based on the first epsilon theorem, which applies, e.g., to elementary geometry and to 
arithmetic with an open induction rule. This second approach to consistency proofs via 
the first epsilon theorem, however, dates back to the beginning of Hilbert's Programme. 
In a letter from Bernays to Ackermann of October 1929, Bernays refers to this second 
approach as Hilbert's 'verungliickter Beweis' (the 'failed proof). This failed proof is 
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not mentioned in Hilbert's publications of the early 1920s nor into his lectures on the 
subject of 1922 and 1923. A record of the basic idea, a second 'Ansatf, is, however, 
available in the form of a six-page note in Bernays's hand. 

The aim of this paper is to present and analyze this second approach to proving con- 
sistency, and to show how Hilbert's 'verungliickterBeweis' precipitated the later proof 
of the first epsilon theorem by Bernays and Ackermann. Given the role envisaged by 
Hilbert for the e-calculus and the consistency proofs based on it, such an analysis will 
help illuminate not just the genesis of an important proof-theoretic result (the epsilon 
theorem), but also Hilbert's aim and strategy for providing consistency proofs. In the 
following section, we will revisit the first epsilon theorem, and show how it can be used 
to establish consistency results. Following this discussion, I present the suggestion con- 
tained in Hilbert's second Ansatz, and outline why this approach was not pursued by 
Hilbert and his students in the 1920s. A concluding section discusses the relevance of 
the result in the wider context of Hilbert's consistency project. 

2 The first epsilon tlieorem and tlie general consistency 
result 

The epsilon calculus consists in the elementary calculus of free variables plus the 
'transfinite axiom', A{a) — > A(erA(x)). The elementary calculus of free variables is 
the quantifier-free fragment of the predicate calculus, i.e., axioms for propositional 
logic and identity, with substitution rules for free individual {a, b, .. .) and formula (A, 
B, . . .) variables and modus ponens. 

One of the most basic and fruitful results concerning Hilbert's e-calculus is the 
so-called epsilon theorem. It states that if a formula £ containing no e-terms is deriv- 
able in the e-calculus from a set of axioms which also do not contain e-terms, then 
£ is already derivable from these axioms in the elementary calculus of free variables 
(i.e., essentially using propositional logic alone). A relatively easy consequence of this 
theorem (or rather, of its proof) is Herbrand's theorem, and, in fact, one of the first pub- 
lished correct p roofs of Herbrand's theorem is that given by Bernays in Gru ndlagen der 
Mathematik U jHilbert and Bernavsl Il939l) based on the first e-theorem.^ lLeisenrin3 
[l969) even formulates the e-theorem in such a way that the connection to Herbrand's 
theorem is obvious: 

If £■ is a prenex formula derivable from a set of prenex formulas Y 
in the predicate calculus, then a disjunction Z?i V . . . VB;, of substitution 
instances of the matrix of E is derivable in the elementary calculus of 
free variables from a set Y' of substitution instances of the matrices of the 
formulas in Y. 

Even without this important consequence, which was of course not discovered until 
after Herbrand's C193QJ thesis, the first e-theorem constitutes an important contribution 
to mathematical logic. Without the semantical methods provided by the completeness 
theorem for predicate logic, it is not at all clear that the addition of quantifiers in the 
guise of e-terms and the axioms governing them is a conservative extension of the 
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elementary calculus. Keeping in mind the role of epsilon-terms as 'ideal elements' 
in a proof, the eliminability of which is the main aim of a consistency proof of any 
mathematical system formulated with the aid of the epsilon calculus, the first epsilon 
theorem is also the main prerequisite for such a consistency proof. 
Bernays stated the first and second epsilon theorem as follows: 

These theorems both concern a formalism F, which results from the 
predicate calculus by adding to its symbols the £-symbol and also certain 
individual [constant], predicate, and function symbols, and to its axioms 
the e-formula [the transfinite axiom] and furthermore certain proper ax- 
ioms , . . . , *P{ which do not contain the e-symbol. For such a formalism 
F, the two theorems state the following: 

1 . If £ is a formula derivable in F which does not contain any bound 
variables, and the axioms also contain no bound vari- 
ables, then the formula £ can be derived from the axioms *Pi , . . . , *P( 
without the use of bound variables at all, i.e., with the elementary 
calculus of free variables alone ('first epsilon theorem'). 

2. If £ is a formula derivable in F which does not contain the e-symbol, 
then it can be derived from the axioms , . . . , *Pe without the use of 
the e-symbol, i.e., with the predi cate ca lculus alone ('second epsilon 
theorem'), failbert and Bernavsl lT939l 18) 

The predicate calculus is formulated with a substitution rule for free individual and 
formula variables; the elementary calculus of free variables is the quantifier-free frag- 
ment of the predicate calculus (i.e., without quantifier axioms or rules) or equivalently, 
the epsilon calculus without transfinite axioms and without defining axioms for the 
quantifiers. 

A proof that the e-calculus is conservative over the elementary calculus of free 
variables in the way specified by the first epsilon theorem constitutes a proof of consis- 
tency of the e-calculus and of mathematical theories which can be formulated in such a 
way that the first e-theorem applies (i.e., the axioms are quantifier- and e-free). Indeed 
Bernays used the first e-theorem to prove a 'general consistency result' for axiomatic 
theories to which the first e-theorem applies. Let us first outline the consistency proof 
for a very basic arithmetical theory. This theory results from the elementary calcu- 
lus of free variables by adding the constant and successor (+1) and predecessor (5) 
functions. The additional axioms are: 

^ x+l 
X = 5(x+l) 

To prove that the resulting axiom system is consistent, assume there were a proof of 
7^ 0. First, by copying parts of the derivation as necessary, we can assume that every 
formula in the proof is used as the premise of an inference at most once. Hilbert and 
Bernays call this 'resolution into proof threads'. The resulting proof is in tree form; a 
branch of this tree (beginning with an axiom and ending in the end-formula) is a proof 
thread. Next, we can substitute numbers for the free variables in the proof ('elimination 
of free variables'). Bernays describes this as follows: 
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We follow each proof thread, starting at the end formula, until we reach 
two successive formulas 21, 05 where the first results from the second by 
substitution. We record the substitution also in the formula 05, so that we 
get instead of 05 a repetition of the formula 2t. 

If 05 is an initial formula [axiom], then the substitution has been trans- 
ferred to the initial formula. Otherwise, 05 was obtained by substitution 
into a formula £ or by repetition, or as conclusion of an inference 

£ £^05 

\ / 
OS. 

In the first case, we in turn replace £ by 2t, so that the substitutions leading 
from £ to 05 and from S to 21 are recorded simultaneously. (In the case of 
repetition, only one substitution is recorded.) 

In the case of the inference schema [modus ponens], we record the sub- 
stitution leading from 05 to 2t in the formulas £ and £ OS; this changes 
the formula £ if and only if it contains the variables being substituted for 
in the transition from 05 to 2t. In any case, the original inference schema 
with conclusion is replaced by an inference schema 

£* £* 21 

\ / 
21. 

We can proceed in this way until we reach an initial formula in each thread. 
When the procedure comes to its end, each substitution has been replaced 

by a repetition, each inference schema by another inference schema, and 

certai n substitutions have been applied to the initial formulas. llHilbert and Berna\ 
Em 225) 

Remaining free variables can now be replaced by (for individual variables) and = 
(for formula variables). We would thus obtain a proof of 7^ without free variables. 

If we now reduce the variable-free terms in the resulting proofs to standard nu- 
merals by successively replacing 5(0) by and 5(t+ 1) by t, we get a proof where 
each initial formula is either an instance of a tautology, of an identity axiom, or, if the 
original formula was one of the axioms for + 1 and 5, a formula of the form of either 

7^ n+1 
n = n 

(where n is either or of the form OH hi). 

Call an equation of the form n = n 'true' and one of the form n = m, where n 
and m are not identical, 'false'. This can be extended to propositional combinations of 
equations in the obvious way. We observe that the resulting proof has all true initial 
formulas, and since modus ponens obviously preserves truth, all other formulas are 
also true. Since 7^ is false, there can be no proof of 7^ 0. 
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Hilbe rt presented th is proof in his course on the foundations of mathematics in 
1921/22 ( 1922aHl922bl) and outlined the basic approach in his 1922 talk at the meet- 
ing of the Deutsche Naturforscher- Gesellschaft in Leipzig ( 1923a). In a course given 
the following year lll923hHl923ah. B ernays and he extended it to axioms for prim- 
itive recursive functions: lAckermannl ( 1 19241) furth er elaborated it to include second- 
order primitive recursive functions rsee lZachl2003l) . The challenge was to extend it to 
the case where e-terms and the transfinite axiom are also present, leading to Hilbert's 
e-substitution method. There, the aim was to find substitutions not just for the free 
variables, but also for the e-terms, ultimately also resulting in a proof without free or 
bound variables and with true initial formulas. An alternative method is this: Instead 
of treating e-terms together with other terms of the system, eliminate e-terms ^rif. We 
introduce a step at the beginning of the proof which reduces a proof in the e-calculus 
to one in the elementary calculus of free variables as in the first e-theorem. Thus, 
with the first e-theorem in hand, Bernays could later formulate the following 'general 
consistency theorem' : 

Let F be a formalism which results from the predicate calculus by 
adding certain individual, predicate, and function symbols. Suppose there 
is a method for determining the truth value of variable-free atomic formu- 
las uniquely. Suppose furthermore that the axioms do not contain bound 
variables [i.e., no quantifiers and no e-terms] and are verifiable [i.e., ev- 
ery substitution instance is true]. Then the formalism is consistent in the 
strong sense that eve r y deri vable variable-free formula is a true formula. 
dffilbert and Bernavs[ll939l 36) 

Suppose 21 is variable-free and derivable in F. If a formalism F satisfies the conditions, 
then the first e-theorem yields a proof of 21 already in the elementary calculus of free 
variables. The procedures above (resolution into proof threads, elimination of free 
variables) yields a proof of 2t from substitution instances of the axioms of F . Since 
the axioms of F are verifiable, these substitution instances are true, and again, modus 
ponens preserves truth. So 21 is true. The requirement that the truth-value of variable- 
free atomic formulas is decidable ensures that this is a finitary proof: It can be finitarily 
verified that any given proof in fact has true initial formulas (and hence, a true end 
formula). 

3 Hilbert's Verungluckter Beweis 

The first e-theorem is first formulated in print in lHilbert and Bernavsl ( ll93^ . but Hilbert 
had something like it in mind already in the early/mid 1920s. When working on Grund- 
lagen der Mathematik in the late 1920s, Bernays revisited the idea, which had been 
abandoned in favour of the e-substitution method. In correspondence with Ackermann 
in 1929 (discussed below), Bernays refers to 'Hilbert's second consistency proof for 
the e-axiom, the so-called 'failed proof, and suggests ways in which the difficulties 
originally encountered could be fixed. Surprisingly, this 'failed proof, a precursor of 
the first E-theorem, is not to be found in the otherwise highly interesting elaborations 
of lecture courses on logic and proof theory given by Hilbert (and Bernays) between 
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1917 and 1923. The only e vidence that the e-theorem predates Bernays's proof of it in 
iHilbert and Bernavsl (Il939l) are the letter from Bernays to Ackermann from 1929, and 
a sketch of the simplest case of the theorem. 

The sketch in question is a six-page manuscript in Bernays's hand which can be 
found bound with the lecture notes to Hilbert's course Elemente und Prinzipie nfraae n 
der Mathematik, taught in the Summer Semester 1910 in Gottingen (Hilberl ll91(il) . 
Although it bears a note by Hilbert 'Insertion in WS [Winter Semester] 1920 [sic]', the 
notation used in the sketch suggests that it was written after sometime after 1922, when 
the epsilon notation was first introduced. Unfortunately, the only substantial discussion 
of the proof is found in the letter from Bernays to Ackermann from 1929 quoted below. 
The fact that it uses the e-axioms in their final form, suggests that it was written after 
Hilbert and Bernays's 1922/23 course, in which es were still used in their dual forms. 
One would also expect Hilbert to have presented the proof in the course, if it had had 
been available then. The proof is briefly alluded to in a letter from Ackermann to 
Bernays of June 1925 in a way that suggests that it was not a recent proof.^ Thus, the 
proof likely dates from 1923 or 1924. 

The sketch bears the title 'Consistency proof for the logical axiom of choice Ab 
AZaAa, in the simplest case' . In it, we find a proof of the first 8-theorem for the case 
where the substitution instances of the transfinite axiom used in the proof, i.e., the 
so-called critical formulas 

2t(t)^2l(e;,2l(x)) 

are such that 2t(x) contains no e's, and furthermore the identity axioms are not used at 
all. The proof goes as follows. Suppose 

2t(tO ^ 2l(8,2l(x)) 
a(tn) ^ 2t(e,2t(x)) 



are all the critical formulas involving 21 in a proof of ^ 0. First, replace every formula 
^ occurring in the proof by the conditional 2l(ti) ^, and every application of modus 
ponens by the (derivable) inference 

a(ti)^6_ 2t(ti)-^(6^T) 
2t(ti)^T 

Every formula resulting thus from a substitution instance ^ of an axiom (other than the 
critical formula for ti ) is then derivable by 

2t(ti)^y 

The formula corresponding to the £-axiom involving ti is derived using 

a(ti)^(2t(ti)^2l(e,a(x)) 
(2i(ti) ^ (gl(ti) ^ 2i(£,-Sl(x))) ^ (2l(ti) ^ (gl(ti) ^ 2t(£,a(x))) 
2t(ti)^(a(ti)^2t(e,2t(x)) 

7 



The premises of this inference are propositional axioms. Thus we obtain a proof of 
2t(ti ) *8 with only the critical formulas for ti, ...,t„. 

Next, replace every formula in the original proof by the conditional 2l(ti ) ^, 
and also replace ea2l(a) everywhere by ti. The initial formulas of the resulting deriva- 
tion (except those resulting from critical formulas) are again derivable as before. The 
formulas corresponding to the critical formulas are all of the form 

2l(ti)^(2l(t,-)^2t(ti)) 

which are propositional axioms. We therefore now have a proof of 2l(ti) ^0^0 
without critical formulas. Putting the two proofs together and applying the law of 
excluded middle, we have found a proof of ^ using only critical formulas for t2, 
. . . , t„. By induction on n, there is a proof of 7^ using no critical formulas at all. In 
the resulting proof, we can replace 8;c2t(x) everywhere by 0.^ 

In a letter to Ackermann dated October 16, 1929, Bernays discusses this proof and 
suggests ways of extending the result to overcome problems that apparently had led 
Hilbert to abandon the idea in favour of consistency proofs using the e-substitution 
method. The letter begins with a review of the problems the original idea suffered 
from: 

While working on the Grundlagenbuch, I found myself motivated to 
re-think Hilbert' s second consistency proof for the 8- axiom, the so-called 
'failed' proof, and it now seems to me that it can be fixed after all. 

Since I know that it is very easy to overlook something in the area 
of proofs like this, I would like to submit my considerations to you for 
verification. 

The stumbling blocks for the completion of the proof were threefold: 

1 . It could happen that due to the replacements needed for the treatment 
of one critical formula, a different critical formula lost its character- 
istic form without, however, thus resulting in a derivable formula. 

2. Incorporating the second identity axiom, which can be replaced by 
the axiom 

(G) a = b^ {^xA (x, a) = z^A {x,b)) 

in its application to the 8-function [footnote: except in the harmless 
application consisting in the substitution of an 8-functional for an 
individual variable in the identity axiom] — only 8jc2t(x) are involved 
here, where x is an individual variable — caused problems. 

3. Sometimes a new 8-functional appeared after successful elimination 
of an 8-functional, so that overall no reduction was achieved.^ 

The difficulties fisted by Bernays arise already for the 8-theorem in the general case; 
deaUng with number theory, i.e., the induction axiom, in the way outUned requires 
even further extensions of the method. Bernays acknowledges this in the letter, writ- 
ing, 'With the addition of complete induction the method is no longer, i.e., at least 
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not immediately, applicable. For that, your [Ackermann's] method of total substitu- 
tion [i.e., a solving e-substitution] would be the simplest way'. However, even if an 
extension to arithmetic is not immediately available, it seems that Bernays considered 
the 'second proof valuable and interesting enough to fix. To summarize, there are two 
difficulties: The first is that the possibilities in which £-terms can be nested in one an- 
other and in which cross-binding of variables can occur give rise to difficulties in their 
elimination. On the one hand, we replace ex2l(x) by ti in the second step. If £-terms 
other than £x2t(x), but which contain ex'Ql{x), say, ey^{y,£x^{x)) are also present, we 
would obtain from a critical formula 

^{5,^Mx)) ^ *B(e3,<B(y,e;,2tW),e;,2t(x)) 

a formula 

QS(s,ti)^S(e,*B(y,ti),ti) 

which is a critical formula for a new e-term (this is Bernays's point (3)). On the other 
hand, the formula might contain another e-expression, e.g., ey^{x,y), in which 
case the corresponding e-term would be of the form e = Ex'^{x,Ey^{x,y)). A critical 
formula corresponding to such a term is: 

2l(s,ey»(s,y)) 2l(e,2l(x,e,<B(jc,y)),e,*B(8v2l(jc,8yQ5(;c,y)),y)), i.e., 
2l(s,ey»(s,y))^a(e,e,S(e,y)) 

If in this formula the e-term e, Q5(s,y) is replaced by some other term t, we get 

2t(s,t) ^a(e;,a(x,e3,'B(.x,y)),ev*B(e,2l(.x,e,,Q5(x,y)),y)), i.e., 
2t(s,t)->a(e,e,»(e,y)) 

which is no longer an instance of the e-axiom. This is Bernays's point (1). 

The second main difficulty is dealing with equality axioms, for again, the replace- 
ment of an e-term ExWi{x,a) by t might transform an instance of an quality axiom into 

a = b^l = Ex'Qi{x,b) 

which no longer is an instance of an axiom. (This is Bernays's point (2)). 

Bernays's proposed solution is rather involved and not carried out in gener al, but 
it seems to have prompted Ackermann to apply some methods from his own ('1 924 
and von Neumann's (.1927.) e-substitution proofs . Spec ifically, the final version of the 
first e-theorem presented bv lHilbert and Bernavsl(ll939l) . where the solution of the dif- 
ficulties is credited to Ackermann, uses double induction on the rank and degree of 
e-expressions to deal with the first difficulty, and von Neumann's notion of e-types to 
deal with the equality axiom.** 

4 Hilbert's 'Conservativity Programme' and the prac- 
tice of consistency proofs 

A complete understanding of Hilbert's philosophy of mathematics requires an analysis 
of what may be called 'the practice of finitism' . Hilbert was, unfortunately, not always 
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as clear as one would like in the exposition of his ideas about the finitary standpoint 
and of his project of consistency proofs. Only by analyzing the approaches by which he 
and his students attempted to carry out the consistency programme can we hope to get 
a complete picture of the principles and reasoning patterns he accepted as finitary, and 
about his views on the nature of logic and proof theory. The £-substitution method, of 
course, was considered the most promising avenue in the quest for a consistency proof. 
The 'failed proof discussed above shows that an alternative approach was, to a certain 
degree, pursued in parallel to the more well-known substitution method, and adds to the 
understanding we have of Hilbert's approach to proof theory and consistency proofs. 
The 'general consistency result' provides another example of how a consistency proof 
should be carried out according to Hilbert. Its particular interest lies in its general 
nature. Bernays's schematic formulation of the result underlines and makes explicit the 
conditions an axiomatic system should meet in order to be amenable to a consistency 
proof of the required form; it stresses once again the requirement of verifiability and 
decidability of atomic formulas. 

Although Hilbert (and Bernays) have consistently presented the goal of the proof 
theoretic programme as giving a finitary consistency proof of classical, infinitary math- 
ematics, it has become common among commentators to present the aim of Hilbert's 
Programme not as one of finding a proof of consistency, but of finding a proof of con- 
servat i vity of the ideal over the real. Here, an appeal is made to Hilbert's distinction in 
between the ideal and real propositions in formalized mathematics: the 
real propositions are those that have finitary meaning, whereas the ideal propositions 
are those formulas which are added to the real part to 'round out' the theory, to make 
the uniform application of logical inferences possible, and which do not have a direct 
interpretation on finitist grounds (in particular, they may contain unbounded quanti- 
fiers). Hilbert likened the real propositions to those propositions of physical theories 
which can be verified by experiment (Hilbert, 1928, 475), and hence it is natural to 
interpret Hilbert's Programme as an instrumentalist enterprise where proof theory was 
supposed to show that whenever a real proposition can be proved by ideal methods, 
it can be proved by real methods alone. Following Detlefsen ( 1986), 1 shall call this 
real-soundness of ideal, formalized mathematics. The first o ne to pre sent Hilbert's 
Programme as aiming for a finitary proof of real-soundness was Ivon Neumann C 1 9311) . 
It was probably Kr eisel who most consistently and influentially emphasized it in, e.g., 
lll95lU l958: 1968). 

It must first of all be said that neither Hilbert nor Bernays presented the aim of 
the programme as that of finding a proof of real-soundness; they almost always talk of 
consistency, and never explicitly of conservativity or of justifying ideal mathematics 
by showing that whenever a real statement is provable by ideal means, it is also finitar- 
ily provable. In fact, there are only two places I cou ld find where Hilbert formulates 
something close to a conservativity claim. In ( 1923), Hilbert writes: '[A] finite the- 
orem can presumably [vermutlich] always be proved without the transfinite mode of 
inference [. . . ] but this contention is of the same sort as the contention that every math- 
ematical proposition can either be proved or refuted' . The use of 'presumably' and the 
qualification at the end suggest that Hilbert was not convinced that the transfinite is 
conservative over the finite. Moreover, this quote appears in the context of a general 
discussion of mathematical, not mefamathematical proof, and so should not be taken as 
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a gloss on what the metamathema tical consistency proof is supposed to establish. The 
second quote is from lHilberll (Il926 ). where he writes 

For there is a condition, a single but absolutely necessary one, to which 
the use of the method of ideal elements is subject, and that is the proof of 
consistency; for, extension by the addition of ideals is legitimate only if no 
contradiction is thereby brought about in the old, narrower domain, that is, 
if the relations that result for the old objects whenever the ideal objects are 
eliminated are valid in the old domain, (p. 383) 

This is likewise not as exphcit and clear as one would like. Hilbert is here talking about 
the method of ideal elements in general, where this is readily understandable: when we 
extend real analysis to complex analysis by extending the domain to include imaginary 
numbers, the new theory should not prove any theorems about real numbers which 
aren't akeady true in the real numbers. The conservativity requirement formulated 
here is an explanation of consistency of the new ideal elements, theorems about them, 
and their consequences in the 'old, narrower domain', and it is the only place where it 
is so formulated. 

The question then is: what is the 'old, narrower' domain in the case of proof theory; 

what are the real sentences for Hilbert? Hilbert reserved the label 'real formulas' quite 

I 1 

clearly for variable-free formulas. In ( 1926), Hilbert did not use the term 'real' but he 
did say that the domain being extended by ideal objects are 'formulas to which con- 
tentual communications of finitary propositions [hence, in the main, numerical equa- 
tions and inequalities] correspond' (380). Although general propositions of the form 
'for all numerals a, b, a + b = b + a' are finitary propositions, the corresponding free- 
variable formula a + b = b + a\s, 'no longer an immediate communication of something 
contentual at all, but a certain formal object . . . ' which does not mean anything in it- 
self (380). Hubert's 11926) was based on a lecture course given in the Winter semester 
1924-25; and in the lecture notes to that course, Hilbert elaborates on the discussion 
from which the preceding quote is taken: 

The resulting formulas such ?&a + b = b + ado not mean anything 
in themselves, any more than the numerals do, they are only images of 
our thoughts; but from these we can derive propositions, such as 2 + 
3=3+2 and we are thus led to consider these elementary propositions 
also as formulas, and to signify them as such; they then are formulas 
which mean those elementary unproblematic propositions. These formu- 
las, which mean something, are the old objects, only in a new conception: 
all the added formulas, which do not mean anything in themselves, are the 
ideal objects of our theory.^ 

When Hilbert introduces the term 'real proposition', he likewise characterizes them as 
the 'formulas to which correspond contentual communication of finitary propositions 
(mainly numerical equations or inequalities, or more complex communications com- 
posed of these)' (Hilbert, 1928, 470).'" Indeed, if the requirement of real-soundness 
is understood, as Hilbert and von Neumann do, by analogy with physi cal theor i es and 
observation statements, then real propositions must be decidable. So lHilber3 (1 19281 
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475) says that 'only the real propositions are directly capable of verification', and this 
only makes sense if 'real proposition' is understood as a variable-free decidable propo- 
sition about numerals." Since, as Hilbert points out in a slightly different context 
(11928 , 470), 'one cannot, after all, try out all numbers' a verification of a general (free- 
variable) proposition must consist of a general proof, and as such can hardly be called 
'direct'. 12 

Nevertheless, it has become common among commentators on Hilbert to take as 
real all quantifier-free formulas. Since in the formalisms considered, free-variable for- 
mulas are interderivabl e with their univers al closures, one often takes the real formulas 
to be all Hi formulas. ISmorvnskil ( Il977h . for instance, claims that Hilbert's primary 
aim was that of establishing conservativity for Hi -formulas, and that he pursued a con- 
sistency proof (only?) because it seemed mo re tractable and because consistency is 
equivalent to conservativity for Hi -sentences. Prawitd ( Il98ll) similarly states the aim 
of the programme as aiming for 'a demonstration in the real part of mathematics of 
the fact (if a fact) that every provable real sentence is true, i.e., that every sentence be- 
longing to the real part which is proved by possible use of the ideal part is nevertheless 
true (according to the standards of the real part)' (254) where 'the real sentences com- 
prise the decidable ones and the ones of the form VxA(x) where each instance A{t) is 
decidable' (256). He stated furthermore that this was to be done by proving the claim 
that '[f]or each proof p in [ideal mathematics] T and for each real sentence A in T: 
if p is a proof of A in T, then A is true' (257). iKitched ill 9761) holds a similar view, 
and iGiaauintol ( 1 19831 124) adopts Smoryriski's formulation of Hilbert's Programme. 
The question of whether Hi -conservativity was a requirement on or an aim of Hilbert's 
Programme is also of interest because it underlies an argument aga inst Hilbert's Pro- 
gramme based on the first incompleteness theorem ( Detlef serl 1 1 990l) . 

As pointed out above, such a formulation of the aim of Hilbert's Programme is 
not to be found in Hilbert. Hilbert's sparse remarks, as well as those contemporary 
formulations which do focus on conservativity such as von Neumann's (1193111) . call 
for a proof of conservativity for variable-free, decidable sentences only. Moreover, 
and here is where one can bring the historical discussion in the first part of this paper 
to bear, the practice of consistency proof only directly establishes conservativity for 
quantifier-free sentences. Consistency proofs based on the epsilon theorem (e.g., the 
general consistency result) as well as those based on e-substitution showed that one can 
transform a proof of a closed, variable-free formula (perhaps using ideal methods, e.g., 
the transfinite axioms) into a purely real, variable-free proof which essentially amounts 
to a calculational verification of the numerical claim expressed by the end-formula. 

It was only Bernays in the Gmndlagen der Mathematik who drew the conclu- 
sion that the consistency proofs themselves actually established not only the truth of 
variable-free formulas provable by ideal methods, but also of free-variable theorems. 
In this context, Bernays used the term 'verifiable' (verifizierbar): a free-variable for- 
mula 2t(fl) is verifiable if each numerical instance 21(3) is true. He then stated the 
following consequence of consistency proofs: every derivable free- variable formula is 
verifiable (This is a conseq uence of a co nsistency proof for quantifier- free formulations 
of systems of arithmetic in lHilbert and Bernavs.l934„ 248, 298; Bern ays also poi nted it 
out as a consequence of the 'general consistency result' in iHilbert a nd Bern avslll939l 
36). The idea is simple: If 2t(a) (equivalently, \/x^{x) is derivable, then the following 
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method constitutes a finitary proof that, for any 3, 21(3) is true. From the derivation of 
21(a) we obtain a derivation of 21(3) by substitution. The procedure given in the con- 
sistency proof transforms this derivation into a variable-free derivation of 21(3), which 
codifies a finitary calculation that 21(3) is true.'^ 

So why has Hilbert been held to Ili-conservativity of ideal mathematics? iKreise^ 
lll95lh cites Ber nays's r esults; but in Kreisel ( 1960) and later, he instead points to 
an argument in ( iHilberA 1 19281 474). This argument, like Bernays's, shows how a 
finitary consistency proof for a system T yields a finitary proof of every free-variable 
formula provable in T . Unlike Bernays's remark, it does not rely on a particular form 
of the consistency proof, but on the mere assumption that a finitary consistency proof 
is available. Assume there is a derivation of 2l(fl) (equivalently, of Vji:2t(x)). The 
task is to show that, for any given 3, 21(3) is true. Suppose it weren't. Then -121(3) 
would be true, and, because T proves all true variable-free formulas, there would be 
a derivation of -121(3). But from the derivation of 2t(a) we obtain, by substitution, a 
derivation of 21(3), and hence T is inconsistent. But we have a finitary consistency 
proof of T, so this cannot be the case. Hence, 21(3) must be true. (Note that this proof 
uses tertium non datur, but this is a finitarily admissible application to a variable-free 
numerical statement 21(3).) This latter result is presented as a surprising application 
of proof theory. It came several years after the two models of consistency proofs — e- 
substitution and the 'failed proof — had already been worked out. Hence Hilbert here 
articulates a conservation property which, as it turned out, follows from consistency — 
and not, as it were, a property which the consistency proofs were all along supposed to 
establish. 

To the extent Hilbert saw the original aim of his project as one of proving conser- 
vativity, this aim was to prove conservativity for decidable, variable-free 'real' propo- 
sitions, but not for free-variable general propositions. There is only one passage in 
which conservativity for general statements is discussed prior to 1934 (viz., in 1928), 
and there it is presented as an application and not a statement of the project. Both 
the 'failed proof and the 8-substitution method in the writings of Hilbert, Ackermann, 
and von Neumann at the time were given the formulation 'if there were an ideal proof 
of = 1, then there would be a variable-free (real) proof of = 1'. If conservativity 
had played a significant role in the minds of those involved, it would have been obvi- 
ous to formulate the proofs so that they established conservativity. It is interesting to 
note that whereas the e-substitution method only directly establishes conservativity for 
variable-free statements (i.e. by applying it to proofs of variable-free formulas instead 
of the specific 0^1), the 'failed proof could have been formulated for proofs of any 
e-free formula (not just 7^ 0), as it eventually was in the first e-theorem. By itself, this 
would only have yielded a consistency proof for logic; for arithmetic, something like 
the strategy in the 'general consistency result' is needed. It is nevertheless conceivable 
that this possible generalization of the 'failed proof suggested a strategy of how to 
remove in general ideal elements in the form of e-terms from proofs of formulas not 
involving such ideal terms. However, the failed proof was never mentioned in print, 
and likewise it was never noted that it would be possible to generalize the then-existing 
strategies to give conservativity proofs (in particular, e-substitution) until well into the 
1930s. 

In addition to the light they shed on the development of the conceptual framework 
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of Hilbert's Programme, the results about the e-calculus discussed above are, I think, of 
independent and genuine importance. Interest in the historical development of Hilbert's 
Programme has seen a marked increase in the last decade or so, and naturally the e- 
calculus takes center stage in the work on logic in Hilbert's school. Independently 
of Hilbert studies, renewed interest in the theory and applications of the e-calculus 
|Avi2ad and Zach, 2002) warrant a closer look at the foundations and origins of the 
epsilon calculus — the 'failed proof is a rather important part of that story. 
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Notes 

1. iHilbert and Bemav j ll923bl 30-3 1). Following lHilbert and Bemavsl <1934 . we will use the following 
notation: a, b, ... stand for free variables, whereas x, y, ... are bound variables. A, B, ... are formula 
variables. 21, OS, . . . are metavariables for formulas, and n, ^ stand for numerical terms. For uniformity, the 
notation in some quotations has been adju sted . 

2. The t-operator was mentioned in HilberJ il922d) and formally introduced, together with the transfinite 
axiom, in|Hilbert 1 1923). In a course given in Winter 1922/23 (Hilbert and Bernavs, 1923b a), Hilbert and 
Bemays introduce the e-operator for the first time, although initially with the same interpretation (as a coun- 
terexample) as the T-operator In notes appended to the typescript ( 1923b), t he final form of the e-o perator 
and e-axioms appears for the first time. Kneser's notes to the course I Hilbert and Be rnavA >T9233) do not 
contain this final version, suggesting that this change was made after the conclusion of the 1922 /23 course. 

3. The basic idea was presented in Hi lberll iI923ft and in the course mentioned iHilbert and Bemavsl 
ll923hlJ) . for discussion, see Zach 1 2003). Roughly, the idea is this: first replace every e-term by 0. The 
instances of the transfinite axiom for an E-term Ej-2I(x) in the proof then become formulas of the form 
2I(n) 21(0). If this formula is false, 2I(n) is true. In the next iteration of the procedure, replace e^Ql{x) by 
n. The difficulty is to extend this idea to the case where more than one E-term, and in particular, when nested 
e-te rms occur in the proof. 

4. iGentzenI fl933 ) mentions that a version of Herbrand's Theorem is a consequence of his 'Verschaifter 
Hauptsatz'. He does not, however, spell out the details. 

5. Ackermann to Bemays, June 25, 1925. 9pp. ETH Ziirich Library, Hs. 975.96. Ackermann writes: 
'[Critical formulas] are eliminated in the way in which Hilbert wanted to earlier [friiherY (p. 3). Ackermann 
here tries to use the idea of the 'failed proof ' to fix his own faulty E-substitution proof. 

6. Th is is essentially the same proof as the one presented as the 'Hilbertsche Ansatz' bv lHilbert and BemavJ 
Il939l 21). There, the proof is carried out for end formulas 58 instead of the specific 0^0. The only other dif- 
ference is that instead of using induction on n, Bemays constructs one derivation of 2l(ti) A ... A 2l{t„) — > 5 
and n derivations of 2l{t, ) ^, and then applies «-fold case distinction. 

7. 'Anlasslich der Arbeit fiir das Grundlagenbuch sah ich mich dazu angetrieben, den zweiten Hilbertschen 
Wf.-Beweis fiir das E-Axiom, den sogenannten „verungluckten" Beweis, nochmals zu tiberlegen, und es 
scheint mir jetzt, dass dieser sich doch lichtig stellen lasst. 

Da ich weiss, dass man sich im Gebiete dieser Beweise ausserst leicht versieht, so mochte ich Ihnen meine 
Uberlegung zur Priifung vorlegen. 

Die bisherigen Hindemisse fiir die Durchfiihrung des Beweises bestanden in dreierlei: 

I . Es konnte vorkommen, dass durch die Ersetzungen, die bei der Behandlung einer kritischen Formel 
auszufiihren waren, eine andere kritische Formel ihre characteristische Gestalt verier, ohne doch in 
eine beweisbare Formel Uberzugehen. 
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2. Die Beriicksichtigung des zweiten Gleichheits-Axioms, das ja in seiner Anwendung auf die E-Funktion 
[Footnote: abgeselien von der liarmlosen Anwendung, besteliend in d. Einsetzung eines E-Funktionals 
fiir eine Grundvaiiable im Gleichlieits-Axiom.] — es liandelt sicli hier immer nur um eo2l(jc), wobei 
X eine Granrfvariable ist — durch das Axiom 

(G) a = b^ (^xA{x,a) = Ej-A(;c,fo)) 

vertreten werden kann, machte Schwierigkeiten. 

3. Es kam vor, dass nacli gelungener Ausschaltung eines E-Funktionals ein anderes E-Funktional hinzurat, 
sodass im ganzen keine Reduktion nachweisbar war. ' 

Bernays to A ckermann, October 16, 1929. Manuscript, 13 pages. In the possession of Hans Richard Ackermann. 
See also lAck ermann ( 1983). 

8. The pro of of the first epsilon theorem, the 'general consistency result', and Herbrand' s theorem of 
iHilbert and Bernays 1^1939) are also contained in lectures Bernays gaye at Princeton ll935-3d) . 

9. 'Diese so entstandenen Formeln msa + b = b+a bedeuten an sich nichts, so wenig wie die Zahlzeichen, 
sie sind nur Abbilder unserer Gedanken; wohl aber konnen aus ihnen Aussagen abgeleitet werden, wie 
2 + 3 = 3 + 2 und wir kommen so dazu, diese elementaren Aussagen auch als Formeln aufzufassen und zu 
bezeichnen; es sind das dann Formeln, die jene elementaren unproblematischen Aussagen bedeuten. Diese 
Formeln, die etwas bedeuten, sind die alten Gebilde, nur in neuer Auffassung; alle di e hinzugefiigten Fo rmeln 
hingegen, die an sich nichts bedeuten, sind die idealen Gebilde unserer Theorie.' iHilberl 1 1 924^2.% 126- 
127).^ 

10. ISmorvriskil j 1989ft also holds that the real propositions are variable-free formulas, and introduces a 
three-fold distinction between real propositions (variable-free), finitary general propositio ns (quantifier free , 
but containing free variables) and ideal propositions (containing quantifiers). 1 agree with lDetlefsenI i 199(1) 
that Smorynski's reading of Hilbert is flawed; but do not agree with Detlefsen's assessment of the real/ideal 
distinction. This distinction is orthogonal to the finitary/infinitary distinction. The real/ideal distinction is a 
purely syntactic distinction between those formulas which do not contain vaiiables and those that do. Every 
real formula can be immediately interpreted as a pailicular finitary propositions, and its tiuth is decidable. 
The ideal formulas cannot immediately be inteipreted finitaiily, and when they do admit of a finitary in- 
terpretation (e.g., free-variable formulas as statements about 'any given numeral'), these interpretations are 
problematic because they do not obey the usual logical laws (e.g., they are 'incapable of being negated'). 

1 1 . There is no reason to thin k that 'verification' as used here by Hilbert is the same notion as 'verifizierbar' 
in iHilbert and Bemav3.ll934t 238), which does apply to free- variable formulas and indeed even to formulas 
with bound variables. See below. 

12. This interpretation is not undermined by the fact that people outside the Hilbert school did not always 
unders tand 'real proposition' as variable-free; e.g., Wevl 1 1928). In his remarks at the Konigsberg conference 
[1986?, 200-202), Godel suggests that he understands the real (in his terminology: 'meaningful') propositions 
as including not only the variable-free formulas, but also formulas of the form {Ex)F{x). In his review of 
Ivon NeumannH193 1). however, he specifically reports the aim of Hilbert's Programme as 'showing that every 
numerical formula verifiable (calculable) in finitely many steps that can be derived according to the rules of 
the game by which classical mathematics is played must turn out to be correct when actually calculated' 
jGodel, 1986, 249). 

13. Proof theorists will realize that Gentzen's ( 1936) and Ackermann's 1194(1) consistency proofs yield 
conservativity result even for Hi sentences, in the follwing sense: If PA proves \/x 3yA(x,y) t hen th ere is 
a < Efl-recursive function / so that a suitable extension of PRA proves A{x,f{x)). iGentzenI 11936ft only 
vaguely hinted at this consequence in his paper, saying that the reduction rules in his co nsistency proof 
provide a finitist sense to actualist, i.e., infinitary propositions. Again it was iKreisel 1 1 95 ll) who expanded 
on this idea. 



References 

Ackermann, H. R. 1983. 'Aus dem Briefwechsel Wilhelm Ackermanns', History and 
Philosophy of Logic 4, 181-202. 

Ackermann, W. 1924. 'Begriindung des "tertium non datur" mittels der Hilbertschen 
Theorie der Widerspruchsfreiheit', Maf/zemaf/sc/ie Anwa/en 93, 1-36. 



15 



Ackermann, W. 1940. 'Zur Widerspruchsfreiheit der Zahlentheorie', Mathematische 
Annalen 117, 162-194. 

Avigad, J. and Zach, R. 2002. 'The epsilon calculus', Stanford Encyclopedia of Philos- 
ophy, http://plato.stanford.edu/entries/epsilon-calculus/ 

Benacerraf, P. and Putnam, H., eds. 1983. Philosophy of Mathematics, Cambridge: 
Cambridge University Press, 2nd edition. 

Bernays, P. 1935-36. 'Logical calculus'. Unpublished typescript. Institute for Ad- 
vanced Study, Princeton. 

Detlefsen, M. 1986. Hilbert's Program, Dordrecht: Reidel. 

Detlefsen, M. 1990. 'On an alleged refutation of Hilbert's program using Godel's first 
incompleteness theorem'. Journal of Philosophial Logic 19, 343-377. 

Ewald, W. B., ed. 1996. From Kant to Hilbert. A Source Book in the Foundations of 
Mathematics, volume 2, Oxford: Oxford University Press. 

Gentzen, G. 1934. 'Untersuchungen iiber das logische SchlieBen I-IF, Mathematische 
Zeitschrift 39, 176-210, 405^31, English ti-anslation in Gentzen ( 1969, 68-131). 

Gentzen, G. 1936. 'Die Widerspruchsfreiheit der re inen Zahlentheo rie', Mathema- 
tische Annalen 112, 493-565, Enghsh translation in lGentzerJ ( ll969t 132-213). 

Gentzen, G. 1969. The Collected Papers of Gerhard Gentzen, Amsterdam: North- 
Holland. 

Giaquinto, M. 1983. 'Hilbert's philosophy of mathematics', British Journal for Philos- 
ophy of Science 34, 1 19-132. 

Godel, K. 1986. Collected Works, volume 1, Oxford: Oxford University Press. 

Herbrand, J. 1930. Recherches sur la theorie de la demonstration. Doctoral disserta- 
tion. University of Paris, English translation in iHerbrand (, 1 97 L 44-202). 

Herbrand, J. 1971. Logical Writings, Harvard University Press. 

Hilbert, D. 1910. 'Elemente und Prinzipienfragen der Mathematik' , Vorlesung, 
Sommer-Semester 1910. Lecture notes by Richard Courant. Unpublished 
manuscript, 163 pp. Bibliothek, Mathematisches Institut, Universitat Gottingen. 
16.206tl4. 

Hilbert, D. 1922a. 'Grundlagen der Mathematik', Vorlesung, Winter-Semester 1921- 
22. Lecture notes by Paul Bernays. Unpublished typescript. Bibliothek, Mathema- 
tisches Institut, Universitat Gottingen. 

Hilbert, D. 1922b. 'Grundlagen der Mathematik', Vorlesung, Winter-Semester 1921- 
22. Lecture notes by Helmut Kneser. Unpublished manuscript, three notebooks. 



16 



Hilbert, D. 1922c. 'Neubegriindung der Mathematik: Evsle Mitteilung', Abhandlungen 
aus dem Seminar der Hamburgischen Universitdt 1, 157-77, series of talks given 
at the Uni v ersity of Hamburg, July 25-27, 1921. Reprinted with no tes by Bernays 
inlHilbert ( 1935, 157-177). EngUsh translation in lMancosul (Il998l 198-214) and 
lEwald(.1996 . 1115-1134). 

Hilbert, D. 1923. 'Die logischenGrundlagen der Mathematik', Mflf/zemafwc/zeAnnaZen 
88, 151-165, lectur e given at the Deutsche Naturforscher-Gesellsch aft, Sep t ember 
1922. Reprinted in Iffilbertl d 19351 178-191). EngHsh translation in lEwaldl ( Il996l 
1134-1148). 

Hilbert, D. 1924-25. 'Uber das Unendliche', Vorlesung, Winter-Semester 1924-25. 
Lecture notes by Lothar Nordheim. Unpublished typescript. Bibliothek, Mathema- 
tisches Institut, Universitat Gottingen. 

Hilbert, D. 1926. 'Uber das Unendliche', Mathemati sche Annalen 95, 161- 90, lecture 
given Miinster, 4 June 1925. English translation in lvan HeiienoortI ll 19671 367-392). 

Hilbert, D. 1928. 'Die Grundlagen der Mathematik', Abhandlungen aus dem Semi- 
nar der Hamburgischen Universitdt 6, 65-85, English translation in lvan HeiienoortI 
([l967, 464-479). 

Hilbert, D. 1935. Gesammelte Abhandlungen, volume 3, Berlin: Springer. 

Hilbert, D. and Bernays, P. 1923a. 'Logische Grundlagen der Mathematik', Winter- 
Semester 1922-23. Lecture notes by Helmut Kiieser Unpublished manuscript. 

Hilbert, D. and Bernays, P. 1923b. 'Logische Grundlagen der Mathematik' , Vorlesung, 
Winter-Semester 1922-23. Lecture notes by Paul Bernays, with handwritten notes 
by Hilbert. Hilbert-NachlaB, Niedersachsische Staats- und Universitatsbibliothek, 
Cod. Ms. Hilbert 567. 

Hilbert, D. and Bernays, P. 1934. Grundlagen der Mathematik, volume 1, Berlin: 
Springer. 

Hilbert, D. and Bernays, P. 1939. Grundlagen der Mathematik, volume 2, Berlin: 
Springer. 

Kitcher, P. 1976. 'Hilbert's epistemology'. Philosophy of Science 43, 99-1 15. 

Kreisel, G. 1951. 'On the interpretation of non-finitist proofs. Part I', Journal of Sym- 
bolic Logic 16, 241-267. 

Kreisel, G. 1958. 'Hilbert's programme', Dialectica 12, 346-372, reprinted as lKreisell 
&83). 

Kreisel, G. 1960. 'Ordinal logics and the characterization of informal notions of proof, 
in J. A. Todd, ed., 'Proceedings of the International Congress of Mathematicians. Ed- 
inburgh, 14-21 August 1958', 289-299, Cambridge: Cambridge University Press. 

Kreisel, G. 1968. 'A survey of proof theory'. Journal of Symbolic Logic 33, 321-388. 



17 



Kreisel, G. 1983. 'Hilbert's programme', in jBenacerraf and PutnamLll983l) . 207-238. 



Leisenring, A. C. 1969. Mathematical Logic and Hilbert's Z-Symbol, London: Mac- 
Donald. 

Mancosu, P., ed. 1998. From Brouwer to Hilbert. The Debate on the Foundations of 
Mathematics in the 1920s, Oxford: Oxford University Press. 

Prawitz, D. 1981. 'Philosophical aspects of proof theory', in G. Fl0istad, ed., 'Contem- 
porary Philosophy. A New Survey', volume 1, 235-77, The Hague: Nijhoff. 

Smorynski, C. 1977. 'The incompleteness theorems', in J. Barwise, ed., 'Handbook of 
Mathematical Logic', 821-865, Amsterdam: North-Holland. 

Smorynski, C. 1989. 'Hilbert's programme', CWI Quarterly 1, 3-59. 

van Heijenoort, J., ed. 1967. From Frege to Gddel. A Source Book in Mathematical 
Logic, 7S97-795i, Cambridge, Mass.: Harvard University Press. 

von Neumann, J. 1927. 'Zur Hilbertschen Beweistheorie', Mathematische Zeitschrift 
26, 1^6. 

von Neumann, J. 1931. 'Die formalistische Grundlegung der Mathematik', Erkenntnis 
2, 116-34, English translation in: Benacerraf and Putnam (1983, 61-65). 

Weyl, H. 1928. 'Diskussionsbemerkungen zu dem zweiten Hilbertschen Vortrag iiber 
die Grundlagen der Mathematik', A/j/zawcZ/Mngen aus de m Mathematischen Sem inar 
der Universitdt Hamburg 6, 86-88, English translation in lvan Heiienoortl ( |l967l 480- 
484). 

Zach, R. 2003. 'The practice of finitism. Epsilon calculus and consistency proofs in 
Hilbert's Program', Synthese Forthcoming. 



18 



